{"id":17540,"date":"2024-04-12T10:03:00","date_gmt":"2024-04-12T08:03:00","guid":{"rendered":"https:\/\/www.savecall.de\/when-more-cyber-security-is-too-much\/"},"modified":"2026-08-03T15:07:52","modified_gmt":"2026-08-03T13:07:52","slug":"when-more-cyber-security-is-too-much","status":"publish","type":"post","link":"https:\/\/www.savecall.de\/en\/when-more-cyber-security-is-too-much\/","title":{"rendered":"When more cyber security is too much"},"content":{"rendered":"\n

\n

\n

When More Cyber Security Is Too Much<\/h1>\n<\/div>\n\n\n\n

Trusted Advisor for IT & Telecommunications Sourcing<\/h3>\n<\/div>\n\n\n\n
\n
\n
Cyber security: why less is often more<\/h2>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
Cyber Security: When Less Is More<\/h2>\n\n\n\n
Complexity is the greatest enemy of effective security<\/h6>\n\n\n\n
Many companies believe that more security tools<\/a> offer better protection, but the opposite is often the case. Overloaded systems, a lack of integration and endless interfaces slow down reactions and create dangerous gaps. The key lies in simplification, as part of a clear security strategy<\/a>: clarity instead of chaos.<\/p>\n\n\n\n
The question:<\/strong> Does your current security stack really deliver protection, or just complexity?<\/em><\/p>\n\n\n\n
<\/div>\n\n\n\n
Auf den Punkt gebracht:<\/strong><\/p>\n\n\n\n
\n
Reduction of redundant security tools and data sources<\/li>\n\n\n\n
Integration of central systems for faster detection and response<\/li>\n\n\n\n
Focus on transparency instead of functional diversity<\/li>\n\n\n\n
Standardization of security operations and monitoring<\/li>\n\n\n\n
Greater efficiency through clear processes and responsibilities<\/li>\n<\/ul>\n\n\n\n
<\/div>\n\n\n\n
Die L\u00f6sung:<\/strong> SAVECALL helps connect existing and new security solutions into one clear, integrated architecture, instead of stacking ever more tools side by side.<\/p>\n\n\n\n
Worum es in diesem Beitrag geht:<\/strong> Why more security tools rarely mean more protection, what attackers really exploit, and how companies become safer through focus instead of feature sprawl.<\/p>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Table of contents<\/h3>\n\n\n\n
\n
More security tools create more complexity, not more security<\/a><\/li>\n\n\n\n
Why integration matters more than more tools<\/a><\/li>\n\n\n\n
More technology does not mean more security<\/a><\/li>\n\n\n\n
The right approach: focus instead of feature sprawl<\/a><\/li>\n\n\n\n
Frequently asked questions about security complexity<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n

\n
\n
\n
\n
\n
\n
\n
\n
\n<\/p>\n\n\n
\n
\n
More security tools create more complexity, not more security<\/h2>\n\n\n\n
The view that more security tools mean better protection still persists, but security researcher Etay Maor argues that success in cyber security lies in simplicity.<\/p>\n\n\n\n
“Growth creates complexity, which requires simplicity” – Mike Krzyzewski.<\/p>\n\n\n\n
There is a widespread misconception that the more security tools a company uses, the better its security situation. It is therefore not surprising that companies use more than 70 security products on average. Furthermore, it is hardly surprising that with each additional offering, complexity increases and efficiency decreases. While this may not be a major problem for Fortune 100 companies with their virtually unlimited security budgets, it is a challenge for everyone else.<\/p>\n\n\n\n
One of the fundamental problems in cyber security is that product diversity leads to complexity. The layered security approach that organizations have adopted over the years is designed to protect against the ever-changing threat landscape and the growing complexity of attacks.<\/p>\n\n\n\n
Why integration matters more than more tools<\/h2>\n\n\n\n
However, each layer consisted of several unconnected offerings, which meant that security researchers became integration engineers. They had to try to link all the elements together. How exactly do you capture and correlate signals and indicators from different sensors, filter them, normalize the data, scan for false positives, assess the relevance of the data to your requirements, and more? How are multiple threat feeds captured, prioritized and checked for false positives<\/a>? How can you ensure that everything works seamlessly together to ensure the best possible security posture?<\/p>\n\n\n\n
You can’t do that!<\/strong><\/p>\n\n\n\n
The proof is in the so-called dwell time: most threat actors linger in organizations’ networks for weeks, if not months, before launching their attack.<\/p>\n\n\n\n
At this critical stage of the attack, IT has many ways to detect, contain and even prevent an attack. While on the organization’s network, attackers gather passwords and secure their continued existence on the network using tools already on the system, such as WMI or PowerShell (or LOL, which stands for “Living Off the Land”), through to custom tools performing privilege escalations, lateral movement to identify crown jewels, preparing exfiltration tunnels and more, all while bypassing security controls<\/a>.<\/p>\n\n\n\n
This disproves another old cyber security myth that says: “the attackers have to be right just once, and the defenders have to be right all the time.” This myth is an oversimplification of what really happens in a breach. In fact, the exact opposite is true. The attackers have to be right every single step of the way to achieve their goal, while IT has multiple potential choke points where they could have detected, mitigated or prevented the attack. Why do Sec Ops keep overlooking these signals?<\/p>\n\n\n\n
More technology does not mean more security<\/h2>\n\n\n\n
In many of these cases, all the signals were present but somehow overlooked. This raises some key questions: do new tools add fat or muscle to the security stack? Do they make the analyst’s job easier, or do they just create more complexity? Do they now need to monitor another screen to detect a potential signal? Do we start a new integration project with every tool that takes weeks or months? Will the whole thing be delayed even more if team members leave? Will we lose focus on security and end up with integration and testing instead?<\/p>\n\n\n\n
Attackers have several advantages over defenders: they have the initiative, are far more agile, adapt and change faster. However, a close look at many breaches revealed that they still use the same tools and techniques, phishing, password cracking and vulnerability scanning. It’s not the “what” that they have changed, but the “how”.<\/p>\n\n\n\n
The right approach: focus instead of feature sprawl<\/h2>\n\n\n\n
We need to rethink our defenses. Instead of constantly adding new functions, we should make better use of what already exists in cyber security, not simplified, but clearer, more comprehensive and more manageable. The goal: efficiency through focus, not through function.<\/p>\n<\/div>\n<\/div>\n\n\n

\n
\n<\/p>\n

\n
\n<\/p>\n\n\n
\n
\n
\n
How SAVECALL creates security through simplicity<\/h3>\n\n\n\n
<\/div>\n\n\n\n
We do not support you with a multitude of different security systems from different providers, but instead help you establish security systems that bring exactly this simplification: more transparency and less effort.<\/p>\n\n\n\n
<\/div>\n\n\n\n
Conclusion: fewer tools, more security<\/strong><\/h3>\n\n\n\n
<\/div>\n\n\n\n
It is not the number of security tools that determines how well a company is protected, but how well they are integrated and how quickly a team can turn their signals into a decision. Companies that consolidate existing systems instead of constantly adding new ones regain transparency, relieve their security team, and close exactly the gaps that attackers exploit unnoticed for weeks in overloaded environments.<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
\n
\n
\n
\n
$\"Frank$ <\/figure>\n<\/div>\n\n\n\n
\n
Written by<\/p>\n\n\n\n
Frank Frommknecht<\/h3>\n\n\n\n
Key Account Consultant, SAVECALL<\/strong><\/p>\n\n\n\n
Has supported companies for over 20 years in selecting and optimizing their connectivity solutions. His focus: making complex telecommunications understandable from the customer’s perspective and finding the right strategic solution.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Why<\/h2>\n\n\n\n
$\"\"$ <\/figure>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
Telecom & IT sourcing. Worldwide. Carrier-independent.<\/h3>\n\n\n\n
<\/div>\n\n\n\n
Selection & operation of worldwide connectivity & cloud infrastructure. Without vendor risk & unnecessary costs.<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
80+ carriers worldwide<\/li>\n\n\n\n
One point of contact<\/li>\n\n\n\n
One SLA<\/li>\n\n\n\n
One portal: mySAVECALL<\/li>\n\n\n\n
Min. 20% savings<\/li>\n<\/ul>\n<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
\n
25+
years of experience<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
40+
Employees<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
80+
Partner<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
1400+ Clients<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
\n
\n
Sources<\/h3>\n\n\n\n
\n
Etay Maor, security researcher, cited for the principle of simplicity as a security strategy<\/li>\n\n\n\n
Mike Krzyzewski, “Growth creates complexity that requires simplicity”<\/li>\n\n\n\n
MITRE ATT&CK, Living off the Land Techniques, last accessed 2026<\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
Frequently asked questions about security complexity<\/h3>\n\n\n\n
Why don’t more security tools automatically make a company safer?<\/strong>
Companies use more than 70 security products on average, often without clean integration. Each additional tool creates its own interfaces, its own alerts and its own false positives that security teams must correlate manually. Instead of more protection, this creates more noise, and real signals get lost in the volume. What matters is not the number of tools but how well they work together and how quickly a team can turn them into a decision.<\/p> <\/div>
What does dwell time mean in a cyberattack?<\/strong>
Dwell time describes the period an attacker spends undetected in the network before launching their actual attack, often weeks to months. During this phase, attackers gather passwords, escalate privileges and prepare exfiltration paths, usually using tools already present in the system, such as PowerShell. This long phase gives IT several opportunities to detect and contain the attack, provided the existing signals are not overlooked amid tool complexity.<\/p> <\/div>
Is it true that attackers only need to be right once, but defenders always?<\/strong>
No, this common myth oversimplifies reality. Attackers have to be right at every single step of their attack chain, from initial compromise through privilege escalation to exfiltration. IT, meanwhile, has multiple potential choke points where it could detect, mitigate or stop the attack. The problem is rarely a missing signal, it is more often that the signal gets overlooked in an overloaded, poorly integrated security stack.<\/p> <\/div>
How do you tell if a new security tool actually helps or just adds complexity?<\/strong>
A new tool should make the analyst’s job easier, not create additional screens and integration projects that take weeks or months. Check whether it replaces existing data sources rather than merely adding to them, whether it fits seamlessly into existing processes, and whether it remains usable when team members leave. If a tool distracts from the actual security focus toward pure integration and testing, it adds fat rather than muscle to the security stack.<\/p> <\/div>
What do attackers actually change when they succeed: the tools or the method?<\/strong>
Closer analysis of many security incidents shows that attackers mostly use the same tools and techniques: phishing, password cracking and vulnerability scanning. What has changed is not the what but the how, meaning the speed, agility and adaptability with which attackers operate. Defenders therefore benefit less from ever more tools against new threats than from faster, clearer processes around existing security measures.<\/p> <\/div>
How does SAVECALL help companies achieve security through simplicity?<\/strong>
SAVECALL does not broker an arbitrary multitude of security systems from different vendors, but helps connect existing and new security solutions into one clear, integrated architecture. The focus is on simplification: fewer redundant tools, centralized detection and response, and transparency about actual security status, instead of one more screen to monitor.<\/p> <\/div> <\/div>\n\n\n
<\/p>\n\n\n
\n
\n
Articles that may also interest you<\/h2>\n<\/div>\n\n\n\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-security-service-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-costs-site-connectivity<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-monitoring-visibility-operation<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-sla-mttr-what-counts<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
cloud-phone-system-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Mobile radio management<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Mobile Provider Comparison 2026<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Internet Connection Which Provider Fits<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Consulting<\/p>\r\n <\/div>\r\n\r\n
\r\n
why-vendor-sprawl-destroys-agility<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
AI-Enabled Networks: Why Bandwidth Alone Isn’t Enough\u2014and What CIOs Really Need to Focus On<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Global Connectivity from a Single Source<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
nis2-telecom-infrastructure<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"WAN$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-sd-wan-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
sase-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
Why cloud security is important<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Savecall$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
Second acquisition in twelve months: Savecall takes over landline customers from Bluestring<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
What and where are the challenges for the network infrastructure of most companies?<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL Holding GmbH founded: Clear structure. Strong foundation. Long-term partnership.<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
Mastering Shadow AI with SASE: Security and transparency for Gen-AI in the company<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Luftaufnahme$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
10 advantages of mobile device management<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Modern$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
Insights into the requirements of a modern workplace<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n <\/div>\r\n\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n\r\n